The FBI has called on THORChain node operators, along with other decentralized finance (DeFi) platforms, to block transactions associated with funds stolen in the recent $6.3 billion Binance hack. The request, made on October 31, followed the agency’s identification of hundreds of related wallet addresses allegedly tied to the incident.
FBI links funds to North Korean group
Investigators attributed the large-scale theft to TraderTraitor, a hacking collective believed to be tied to North Korea. According to the FBI, the stolen cryptocurrency was being laundered and converted into Ether through a variety of blockchains and cross-chain services.
Authorities have published 628 related blockchain addresses, including 608 linked to Ethereum, 19 to Bitcoin, and one to Solana. Notably, the list excluded any addresses related to Tron, a blockchain frequently used for transferring the stolen funds in this case.
THORChain co-founder Chad Barraford told The Block that while THORChain’s official site has blocked the compromised addresses identified by the FBI, the platform’s decentralized structure limits the ability to enforce blanket blocks across all independent node operators.
Barraford indicated that node operators are already able to observe and identify flagged transactions on public blockchains, but he does not expect independent participants to halt trading due to the FBI’s request.
Mini dictionary: THORChain is a decentralized protocol that lets users swap assets across multiple blockchains without using intermediaries. Its network relies on independently operated nodes rather than a single controlling authority.
Limits of frontend controls
While the THORChain website has implemented restrictions on the blacklisted addresses, the underlying protocol operates independently from the site itself. Users can interact with THORChain through alternative interfaces, making it impossible for the website alone to fully prevent further transactions involving the stolen assets.
This decentralized network structure means node operators are not directly compelled to comply with external demands, creating a gap between user-facing website controls and the core protocol’s operations.
Trading halted amid unrelated technical issue
On the same day as the FBI’s request, THORChain was forced to suspend trading on 10 out of 13 connected blockchains following an Ethereum block reorganization. The disruption caused the protocol to refund 10 ETH to vaults that had never received deposits, signaling a shortfall detected by its solvency checker.
As the halt extended, all protocols experienced trading suspensions, affecting both legitimate users and those potentially connected to the illicit funds. The trading halt, however, was related to protecting the platform’s operations—not as a direct response to the FBI’s appeal.
The measures undertaken to freeze trading were designed to maintain network security following the Ethereum reorganization, according to protocol participants.
| Chain | Status After October 31 |
|---|---|
| Ethereum | Trading suspended |
| Other 9 chains | Trading suspended |
| Remaining 3 chains | Trading active |
Tracing the scope of stolen funds
Analyst SomaXBT estimated that $242 million was laundered through Tron over a two-day period, with an estimated $140 million passing through various cross-chain protocols. Relay handled nearly $48 million, THORChain facilitated $44 million, Chainflip enabled the movement of $32.1 million, and Symbiosis accounted for $16 million in transferred assets. These numbers remain approximate as funds moved swiftly and unpredictably across services.
No evidence suggests the THORChain protocol or its operators knowingly facilitated transfers for the perpetrators of the attack.
Wallet screening and compliance challenges
The ongoing movement of funds complicates efforts to screen or block compromised wallets in real-time. Blockchain analytics firm Elliptic reported tracking 12,000 wallets and over 40,000 transactions on 11 different chains in less than four days, observing signs of automated laundering strategies.
While analysts such as Taylor Monahan have pointed out that a supermajority of node operators—about two-thirds—could theoretically coordinate to block suspicious activity, Barraford stressed that achieving such consensus could take several days or weeks, making near-instant responses effectively impossible.
A faster reaction would shift more power to centralized authorities, undermining the DeFi principle of decentralization.
Impact on Binance and DeFi confidence
In parallel with the investigation, Binance, one of the largest global cryptocurrency exchanges, has implemented proof of reserves to reassure customers their balances are fully backed. The company also pledged to cover losses incurred by the hack.
Despite these measures, Binance recorded net customer outflows of $4.72 billion, equivalent to 3% of platform assets, even as $2.7 billion in deposits flowed in. The incident raises ongoing questions about the ability of DeFi protocols to maintain liquidity and compliance while upholding user trust amid sophisticated criminal efforts.
